ProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable

ProjectDiscovery Inc. added Neo Triage to its Neo security testing platform, which reproduces each reported vulnerability against the live asset from an isolated sandbox and returns a verdict of valid, duplicate or spam with the exact traffic as evidence. ProjectDiscovery estimates manual review of a 100,000-finding backlog takes about 50,000 hours — enough to keep 25 people busy for a year — versus roughly 8,300 hours reviewing Neo's verdicts, and co-founder and CEO Rishi Sharma said "The hard part now is deciding which findings matter, and a score can't make that decision. Proof can." Neo Triage is available now in every Neo tier including the free one, and findings can be ingested from HackerOne, GitHub security advisories, security mailboxes, Qualys and Orca Security or any tool with an API.

ProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable Open-source cybersecurity company ProjectDiscovery Inc. https://projectdiscovery.io/ today added Neo Triage to its Neo security testing platform to confirm which reported vulnerabilities can actually be exploited before teams start fixing them. The new capability goes after the triage backlog, which ProjectDiscovery blames on artificial intelligence. Scanners, AI code review and AI-assisted bug hunting now turn up findings faster than security teams can get through them. Each of those findings still has to be reproduced by hand, and the company said that takes anywhere from 15 minutes to four hours apiece. Neo Triage tries to reproduce every incoming finding against the live asset it was reported on. The tests run from an isolated sandbox, and ProjectDiscovery said they are built not to damage the systems being probed. Each check ends with a verdict such as valid, duplicate or spam, and the exact traffic from it goes to the reviewer as evidence. Severity follows from the impact the test demonstrated. Neo also looks at how exposed the asset is, what data sits behind it and what else an attacker could reach from it. The findings themselves can come from HackerOne Inc., GitHub security advisories, security mailboxes and scanners such as Qualys Inc. and Orca Security Ltd., and all of them land on a single board. Any other tool with an application programming interface can be connected too. Once a finding is confirmed, Neo suggests a fix and drafts a reply to the researcher who reported it. A retest runs on its own after the change ships. An insights dashboard tracks the open backlog and service-level agreement status, and it also grades each source on the quality of what it sends in. Rishi Sharma, co-founder and chief executive of ProjectDiscovery, expects triage to be the biggest problem security teams face over the next six to 12 months. Most organizations already have thousands of findings open, he said, and some have millions. “The hard part now is deciding which findings matter, and a score can’t make that decision,” Sharma said. “Proof can.” The company estimated that working through a backlog of 100,000 findings by hand would take about 50,000 hours, enough to keep 25 people busy for a year. Reviewing Neo’s verdicts on the same backlog would come to roughly 8,300 hours by the company’s count. ProjectDiscovery is a venture capital-backed startup that raised $25 million in a Series A round led by CRV in 2023 https://projectdiscovery.io/blog/announcing-projectdiscovery-cloud-platform-25-million-series-a-2 . Its best-known tool is Nuclei, an open-source scanner that the company says has logged more than 10 billion scans. Neo, which runs on the set of tools that grew up around it, went on sale in March https://www.prnewswire.com/news-releases/projectdiscovery-launches-neo-an-advanced-security-testing-platform-that-finds-and-proves-real-vulnerabilities-302723201.html and became generally available in August https://www.prnewswire.com/news-releases/projectdiscovery-makes-neo-generally-available-with-pay-as-you-go-pricing-302842104.html . Neo Triage is available now in every Neo tier, the free one included. Getting started on Neo costs nothing, with monthly usage included and no time limit, and heavier users can move up to Pro or Enterprise plans that run under zero data retention. Image: ProjectDiscovery A message from John Furrier, co-founder of SiliconANGLE: Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network , where technology leaders connect, share intelligence and create opportunities. - 15M+ viewers of theCUBE videos , powering conversations across AI, cloud, cybersecurity and more - 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network Are you an AWS customer? Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: https://siliconangle.com/aws-marketplace/ https://siliconangle.com/aws-marketplace/ About SiliconANGLE Media SiliconANGLE https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fsiliconangle.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=SiliconANGLE&index=9&md5=646b1b564e2259100a2b8638aab0a552 , theCUBE Network https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecube.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Network&index=10&md5=7de2a85f95ab4a4a495cede20b8cb1da , theCUBE Research https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fthecuberesearch.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Research&index=11&md5=7bb33676722925eb57d588ec343e4f6f , CUBE365 https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.cube365.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=CUBE365&index=12&md5=d310fb35919714e66ad8d42c9c0c1bc6 , theCUBE AI https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecubeai.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+AI&index=13&md5=b8b98472f8071b23ebb10ab9a8dd0683 and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.